Privacy policy
Short, without legal noise. If anything here turns out to be untrue, that is a bug to fix, not to explain away.
What we store
Your email address. Sign-in times and IP addresses. A list of devices with the names you gave them. How many records you have, their types and modification times. The size of each encrypted blob. Your encrypted second-factor secret.
What we cannot read
The contents of your records: host names and addresses, logins, passwords, keys. All of it is encrypted on your device with a key derived from your password. We do not have that key.
What is visible anyway
Blob size is metadata: it roughly tells whether a record holds a host or a private key. We have not padded records to a uniform size yet, but we say so plainly.
How long, and how to delete
As long as you use the account. Delete it and records, devices and tokens go immediately, sign-in log rows are anonymised, and backups expire within their retention period.
Who we share with
Nobody. No visitor counters or third-party trackers on this site, no telemetry in the app: a crash report is a file on your disk, sent only when you press the button and only to the address you entered.
Your password
It cannot be recovered. We physically cannot do it. If you lose it, the only honest option is to delete the account and start over.